Skip to Content

    Research Proposal

    Add your abstract and contact information and we will be in touch

    Thanks We will be in touch soon

    Contact us

    Leave a massage and we’ll get back to you

      You can also reach us at:

      Cyber Security Research Center @ Ben-Gurion University of the Negev
      P.O.B. 653
      Beer Sheva, 84105,

      +972 8 6428005
      +972 8 6428121

      Detection of malicious webmail attachments based on propagation patterns

      Yehonatan Cohen, Danny Hendler, Amir Rubin

      Knowledge-Based Systems Volume 141, 1 February 2018, Pages 67-79

      Email remains one of the key media used by cybercriminals for distributing malware. Based on a large data set consisting of antivirus telemetry reports, we conduct the first comprehensive study of the properties of malicious webmail attachments. We show that they are distinct among the general web-borne malware population in terms of the malware reach (the number of machines to which the malware is downloaded), malware type and family. Furthermore, we show that malicious webmail attachments are unique in the manner in which they propagate through the network.

      We leverage these findings for defining novel features of malware propagation patterns. These features are derived from a time-series representation of malware download rates and from the community structure of graphs that model the network paths through which malware propagates. Based on these features, we implement a detector that provides high-quality detection of malicious webmail attachments.

      Back to top